When CORS Broke Our Slide Export

The Incident

01

When CORS Broke Our Slide Export

2 / 12

Export failed during a live demo

• External image pasted into slide deck

• Browser displayed the image normally

• PPTX export fetched image via XHR

• CORS policy blocked the request

A core feature failed in front of our advisor.

When CORS Broke Our Slide Export

3 / 12

Root Cause

02

When CORS Broke Our Slide Export

4 / 12

Different rules for display and reading

Context

Behavior

<img> tag

Renders fine; binary data stays hidden

fetch() / XHR

Blocked without CORS header

The browser enforces CORS only when JavaScript tries to read the bytes.

When CORS Broke Our Slide Export

5 / 12

The image is both innocent and guilty

Displays on the page, then triggers CORS on export

• Visually rendered without effort

• Unreadable when JavaScript asks for data

When CORS Broke Our Slide Export

6 / 12

How We Solved It

03

When CORS Broke Our Slide Export

7 / 12

Two candidate fixes

• Ask image hosts to enable CORS

– Technically valid, practically unrealistic

• Move image fetching to the server

– Server-to-server requests avoid CORS

When CORS Broke Our Slide Export

8 / 12

Hybrid approach wins

Keep layout and slide generation in the browser

Fetch images through the server

Deliver image bytes to the browser

Minimal architectural change, maximum reliability.

When CORS Broke Our Slide Export

9 / 12

Next steps

1. Show a clear error message when export fails

2. Proxy image fetching through the server

When CORS Broke Our Slide Export

10 / 12

Engineering Lesson

04

When CORS Broke Our Slide Export

11 / 12

Rendering is not reading

Understand browser security boundaries before the next generic bug leaks through.

When CORS Broke Our Slide Export

12 / 12